Debusine 0.12.0 contains a vulnerability (CWE-59: Improper Link Resolution) where its parser accepts fully user-controlled paths in Debian source package (.dsc) and upload artifact (.changes) manifest files. This allows an attacker to abuse the mergeuploads task to create arbitrary symbolic links on the worker system, enabling overwriting of files that the worker user can access. The vulnerability has a CVSS 3.1 base score of 6.5 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity but not availability.

An attacker can exploit this vulnerability remotely without authentication to create symbolic links that overwrite files accessible by the worker user on the system running Debusine. This can lead to partial loss of confidentiality and integrity of data on the affected system. There is no indication of impact on availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — no official fix or remediation level has been published by the vendor. Users should monitor the Debian advisory channels for updates and apply any official patches once available. Until then, restricting access to the mergeuploads task and validating input paths may reduce risk.